<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
xmlns:wfw="http://wellformedweb.org/CommentAPI/">
<channel>
<title>Techdirt. Stories about &quot;dropbox&quot;</title>
<description>Easily digestible tech news...</description>
<link>http://www.techdirt.com/</link>
<language>en-us</language>
<image><title>Techdirt. Stories about &quot;dropbox&quot;</title><url>http://www.techdirt.com/images/td-88x31.gif</url><link>http://www.techdirt.com/</link></image>
<item>
<pubDate>Sat, 8 Jun 2013 12:28:00 PDT</pubDate>
<title>More Details On PRISM Revealed; Twitter Deserves Kudos For Refusing To Give In</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20130608/09315223373/more-details-prism-revealed-twitter-deserves-kudos-refusing-to-give.shtml</link>
<guid>http://www.techdirt.com/articles/20130608/09315223373/more-details-prism-revealed-twitter-deserves-kudos-refusing-to-give.shtml</guid>
<description><![CDATA[ Late on Friday, the NY Times released the <a href="http://www.nytimes.com/2013/06/08/technology/tech-companies-bristling-concede-to-government-surveillance-efforts.html?_r=0&#038;pagewanted=all" target="_blank">most detailed explanation to date of the PRISM</a> system that was revealed on Thursday, claiming that nine of the biggest tech and internet companies were working with the NSA to give them "direct access" to servers.  The explanation explains  how both the original story was substantially true, as were the "denials," though the denials were (as predicted) a bit of doublespeak.  Today, the Guardian <a href="http://www.guardian.co.uk/world/2013/jun/08/nsa-surveillance-prism-obama-live?guni=Network%20front:network-front%20full-width-1%20bento-box:Bento%20box:Position2#block-51b36893e4b0cc6424372292" target="_blank">revealed another slide</a> from the presentation it has, which clarifies some more details.
<br /><br />
Basically, it appears those companies all agreed to <i>make it easier</i> for the NSA to access data that was required to be handed over under an approved FISA Court warrant, and they appear to do this by setting up their own servers where they put that information (and just that information).  From the NY Times report:
<blockquote><i>
But instead of adding a back door to their servers, the companies were essentially asked to erect a locked mailbox and give the government the key, people briefed on the negotiations said. Facebook, for instance, built such a system for requesting and sharing the information, they said.
<br /><br />
The data shared in these ways, the people said, is shared after company lawyers have reviewed the FISA request according to company practice. It is not sent automatically or in bulk, and the government does not have full access to company servers. Instead, they said, it is a more secure and efficient way to hand over the data. 
</i></blockquote>
This is significantly less worrisome than the original Washington Post report, which suggested full real-time access to all servers.  That's not quite what has happened, according to this report.  This involves cases where the companies really do need to hand over this information.  We can disagree with whether or not the FISA Court should issue these warrants, but at some point there may be information that the companies do need to hand over to the government.  As for the Guardian, they published the following slide:
<center>
<a href="http://imgur.com/QobV8zD"><img src="http://i.imgur.com/QobV8zD.jpg" width=560"/></a>
</center>
As you can see, it notes multiple programs where they can get data.  The programs on top are the ones such as the NSA servers installed at telcos to collect all traffic running through them, which have been revealed before.  The program on the bottom is PRISM, which clearly states: "collection directly from the servers of these U.S. Service Providers," followed by the already known list.  That certainly confirms the "direct access" claim from the original WaPo report, but it could also be true in conjunction with the NY Times report, if you look at it as the companies setting up special servers where they place information they're ordered to hand over via FISA court orders.  The "denials" from the companies are also substantially true, as they mean that the NSA isn't getting direct access to <i>all</i> their servers, but rather the ones set up for handing over this information.
<br /><br />
The real question should be about <b>what information</b> the FISA Court is approving warrants over:
<blockquote><i>
FISA orders can range from inquiries about specific people to a broad sweep for intelligence, like logs of certain search terms, lawyers who work with the orders said. There were 1,856 such requests last year, an increase of 6 percent from the year before.
<br /><br />
In one recent instance, the National Security Agency sent an agent to a tech company&#8217;s headquarters to monitor a suspect in a cyberattack, a lawyer representing the company said. The agent installed government-developed software on the company&#8217;s server and remained at the site for several weeks to download data to an agency laptop.
<br /><br />
In other instances, the lawyer said, the agency seeks real-time transmission of data, which companies send digitally. 
</i></blockquote>
Note just how broad some of those searches may be.  Staying around for weeks to download logs?  We're not talking about narrowly focused searches here.
<br /><br />
Of course, what's now also come out is that, despite Google and Microsoft <a href="http://www.techdirt.com/articles/20120618/15431719372/googles-latest-transparency-report-shows-increased-censorship-governments-not-normally-known-censorship.shtml">releasing</a> transparency <a href="http://www.techdirt.com/articles/20130322/02545222415/microsoft-releases-details-law-enforcement-requests.shtml">reports</a> about government requests for data, they <b>don't include</b> FISA requests because of the gag orders on them.  It's only recently that both Google and Microsoft were able to include "range" numbers for how many national security letter requests they get.  One hopes they're pushing to be transparent on FISA requests as well.
<br /><br />
The article makes it clear that Twitter was alone among the companies in refusing to join this program.  That <b>does not</b> mean that Twitter does not hand over data to the government when receiving a legitimate FISA order.  I'm sure it does.  But it does mean that they have not set up a special system to make it easy for the government to just log in and get the data requested.  Some people have suggested that the government has little need for Twitter to join the program since nearly all Twitter information is public, but that's not true.  There is still plenty of important information that might be hidden, including IP addresses, email addresses, location information and direct messages that the NSA would likely want.  Besides, YouTube is a part of the program, and most of its data is similarly "public."
<br /><br />
This is not, by the way, the first time that we've seen Twitter stand up and fight for a user's rights against a government request for data.  Over two years ago, we pointed out that Twitter, alone among tech companies, <a href="http://www.techdirt.com/articles/20110110/01084212585/kudos-to-twitter-not-just-rolling-over-when-us-govt-asked-info.shtml">fought back</a> when a court ordered it to hand over user info.  Twitter sought, and eventually got, permission to tell the user, and allow that user to try to fight back.  It later came out that, as part of that same investigation, the government also had requested information from <a href="http://www.techdirt.com/articles/20111010/11573016287/finally-revealed-feds-sought-info-google-sonicnet-about-wikileaks-helpers.shtml">Google and Sonic.net</a>, with Sonic.net fighting back and losing.  It never became clear whether Google fought back.
<br /><br />
Separately, however, Chris Soghoian has noted that an "unnamed company" <a href="https://twitter.com/csoghoian/status/343095614990585856" target="_blank">fought back and lost</a> against a FISA court order... and that, according to the PowerPoint presentation, Google "joined" PRISM just a few months later.  It is possible that Google fought joining the program, and then only did so after losing in court.  That said, Google's <a href="https://plus.google.com/app/basic/stream/z13gcbqwdkrailmgx04cdp3jxuf5cz2a3e4" target="_blank">most recent denial</a> insists that "the government does not have access to Google servers&#8212;not directly, or via a back door, or a so-called drop box."  Perhaps they don't consider a special server set up for lawfully required information a "drop box," but others certainly might.
<br /><br />
In the end, it appears that the initial Washington Post report <i>was</i> overblown in that it suggested direct access to <i>all</i> servers, rather than specific servers, set up to provide information that was required.  That said, it is still true that the FISA Court appears to issue a fair number of secret orders for information from a variety of technology companies, some of them quite broad, and that many of the biggest tech companies have set up systems to make it easier to give the NSA/FBI and others access to that info -- though, they are often required by law to provide that information.  The real outrage remains that all of this is happening in complete secrecy, where there is little <i>real</i> oversight to stop this from being abused.  As we noted just a few weeks ago, the FISA Court has <a href="http://www.techdirt.com/articles/20130505/19242922955/us-secret-surveillance-court-approves-all-requests-second-year-row.shtml">become a rubber stamp</a>, rejecting no requests at all in the past two years.
<br /><br />
Given the revelations of the past week, the public (and our representatives) need to demand much more transparency and oversight concerning these surveillance programs.<br /><br /><a href="http://www.techdirt.com/articles/20130608/09315223373/more-details-prism-revealed-twitter-deserves-kudos-refusing-to-give.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20130608/09315223373/more-details-prism-revealed-twitter-deserves-kudos-refusing-to-give.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20130608/09315223373/more-details-prism-revealed-twitter-deserves-kudos-refusing-to-give.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>details-details-details</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20130608/09315223373</wfw:commentRss>
</item>
<item>
<pubDate>Thu, 6 Jun 2013 15:35:00 PDT</pubDate>
<title>Oh, And One More Thing: NSA Directly Accessing Information From Google, Facebook, Skype, Apple And More</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20130606/15111523346/another-shoe-drops-nsa-directly-accessing-information-google-facebook-skype-apple-more.shtml</link>
<guid>http://www.techdirt.com/articles/20130606/15111523346/another-shoe-drops-nsa-directly-accessing-information-google-facebook-skype-apple-more.shtml</guid>
<description><![CDATA[ Obviously, the Verizon/NSA situation was merely a small view into just how much spying the NSA is doing on everyone.  And it seems to be spurring further leaks and disclosures.  The latest, from the Washington Post, is that the NSA has <a href="http://www.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companies-in-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_print.html" target="_blank">direct data mining capabilities</a> into the data held by nine of the biggest internet/tech companies:
<blockquote><i>
The technology companies, which participate knowingly in PRISM operations, include most of the dominant global players of Silicon Valley. They are listed on a roster that bears their logos in order of entry into the program: &#8220;Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube, Apple.&#8221; PalTalk, although much smaller, has hosted significant traffic during the Arab Spring and in the ongoing Syrian civil war.
<br /><br />
Dropbox , the cloud storage and synchronization service, is described as &#8220;coming soon.&#8221; 
</i></blockquote>
This program, like the constant surveillance of phone records, began in 2007, though other programs predated it.  They claim that they're not collecting all data, but it's not clear that makes a real difference:
<blockquote><i>
The PRISM program is not a dragnet, exactly. From inside a company&#8217;s data stream the NSA is capable of pulling out anything it likes, but under current rules the agency does not try to collect it all.
<br /><br />
Analysts who use the system from a Web portal at Fort Meade key in &#8220;selectors,&#8221; or search terms, that are designed to produce at least 51 percent confidence in a target&#8217;s &#8220;foreignness.&#8221; That is not a very stringent test. Training materials obtained by the Post instruct new analysts to submit accidentally collected U.S. content for a quarterly report, &#8220;but it&#8217;s nothing to worry about.&#8221;
<br /><br />
Even when the system works just as advertised, with no American singled out for targeting, the NSA routinely collects a great deal of American content. 
</i></blockquote>
I expect we'll be seeing more such revelations before long.<br /><br /><a href="http://www.techdirt.com/articles/20130606/15111523346/another-shoe-drops-nsa-directly-accessing-information-google-facebook-skype-apple-more.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20130606/15111523346/another-shoe-drops-nsa-directly-accessing-information-google-facebook-skype-apple-more.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20130606/15111523346/another-shoe-drops-nsa-directly-accessing-information-google-facebook-skype-apple-more.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>not-a-good-week-for-the-nsa</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20130606/15111523346</wfw:commentRss>
</item>
<item>
<pubDate>Mon, 25 Jun 2012 23:59:00 PDT</pubDate>
<title>Tech Still One Step Ahead: New Service Downloads Torrents Directly To Dropbox</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20120624/23541219454/tech-still-one-step-ahead-new-service-downloads-torrents-directly-to-dropbox.shtml</link>
<guid>http://www.techdirt.com/articles/20120624/23541219454/tech-still-one-step-ahead-new-service-downloads-torrents-directly-to-dropbox.shtml</guid>
<description><![CDATA[ <em><strong>Update:</strong> Well, that didn't take long. Dropbox has already <a href="http://torrentfreak.com/dropbox-bans-bittorrent-startup-boxopus-over-piracy-concerns-120626/" target="_blank">blocked Boxopus</a>.</em>
<br /><br />
Every time some sort of file sharing service is shut down or someone else is arrested, we hear the regular crew of supporters of the existing copyright regime declare victory.  But, every time, people just shift to some other service and move on.  None of it leads people to suddenly spend money again when they hadn't before.  TorrentFreak recently had an article about a service calls Boxopus, which uses Dropbox's API to <a href="http://torrentfreak.com/boxopus-downloads-torrents-to-dropbox-120623/" target="_blank">automatically download content from torrents to a Dropbox file</a>. Think of it as torrenting in the cloud.  From a user perspective, there are plenty of advantages, including the fact that the content is then available on all your synced devices.  Of course, there's also the fact that for an end user, it's somewhat anonymous -- since Boxopus is the "downloader" rather than the user themselves.  So if the content is infringing, it's more difficult to track them down (though, I would imagine not impossible, if someone got access to Boxopus' logs).  Apparently, a number of services have already implemented this as a download option.  Of course, this probably just means that Boxopus will soon be targeted as a "problem" even though it has plenty of non-infringing uses, and actually could be quite handy for all kinds of authorized activities in a more cloud-centric universe.
<br /><br />
Either way, what strikes me about this is a simple fact: the technology always advances.  It sees areas where people try to stop it, and figures out a way to route around it.  Whether or not people <i>like</i> this, it exists, and tons of other, similar offerings will likely exist in short order.  You can fight the tide -- as some seem to want to do -- or you can look at ways that you might take advantage of tools like this.  Only one of those is a winning strategy.<br /><br /><a href="http://www.techdirt.com/articles/20120624/23541219454/tech-still-one-step-ahead-new-service-downloads-torrents-directly-to-dropbox.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20120624/23541219454/tech-still-one-step-ahead-new-service-downloads-torrents-directly-to-dropbox.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20120624/23541219454/tech-still-one-step-ahead-new-service-downloads-torrents-directly-to-dropbox.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>it's-unstoppable</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20120624/23541219454</wfw:commentRss>
</item>
<item>
<pubDate>Wed, 20 Jun 2012 10:49:00 PDT</pubDate>
<title>The Chilling Effects On Innovation Caused By Bad Copyright Law</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/blog/innovation/articles/20120618/16110519373/chilling-effects-innovation-caused-bad-copyright-law.shtml</link>
<guid>http://www.techdirt.com/blog/innovation/articles/20120618/16110519373/chilling-effects-innovation-caused-bad-copyright-law.shtml</guid>
<description><![CDATA[ We've talked a few times about how attacks on new innovations in the name of protecting copyright can create massive chilling effects.  For example, the increasingly <a href="http://www.techdirt.com/articles/20120530/16055119130/megaupload-filings-show-massive-flaws-us-case-ask-court-to-dismiss.shtml">questionable</a> arguments against Megaupload have created a <a href="http://www.techdirt.com/blog/innovation/articles/20120216/03595717776/how-megaupload-shutdown-has-put-cloud-computing-business-plans-risk.shtml">real chill</a> for online cloud storage providers.  That was likely manifest last week in the news that Dropbox was <a href="http://news.cnet.com/8301-1023_3-57453839-93/dropbox-to-kill-off-public-folders/" target="_blank">killing off its "public folders" feature</a> in deference to its link feature, basically making the product less useful.
<br /><br />
Matt Schruers, from CCIA has an interesting blog post up which ties actions like those done by Dropbox here <a href="http://www.project-disco.org/intellectual-property/trans-atlantic-differences-in-cloud-computing-investment/" target="_blank">with a new study showing how the chilling effects of bad copyright law can impact innovation</a>.  The <a href="http://www.ccianet.org/CCIA/files/ccLibraryFiles/Filename/000000000642/eu%20cloud%20computing%20white%20paper.pdf" target="_blank">full study</a> (pdf) is actually something of a follow up to an earlier study we wrote about, which showed how <i>good</i> judicial rulings on copyright which allowed for greater innovation (such as the <a href="http://www.techdirt.com/articles/20080804/1218551884.shtml">Cablevision ruling</a>, which allowed cloud-based DVRs to exist) contributed <i>directly</i> to <a href="http://www.techdirt.com/articles/20111107/12192016669/study-shows-how-sopapipa-will-harm-investment-key-innovations.shtml">greater funding</a> of innovation.
<br /><br />
This new study, also by Harvard professor Josh Lerner, highlights the unfortunate opposite impact: the chilling effects on investment in innovation that comes as a result of anti-innovation judicial rulings.  In this case, Lerner looked at specific rulings in the EU:
<blockquote><i>
We analyze the effects of a court 
ruling in France and several court rulings in Germany on VC investment in cloud computing 
firms in these countries. These court rulings were seen as negatively affecting the development 
of cloud computing, and our findings confirm this view by showing that these rulings regarding 
the scope of copyrights had significant, negative impacts on investment. Specifically, we find 
that VC investment in cloud computing firms declined in Germany and France, relative to the 
rest of the EU, after the French and German rulings. Our results suggest that these rulings led to 
an average reduction in VC investment in French and German cloud computing firms of $4.6 and 
$2.8 million per quarter, respectively. This implies a total decrease in French and German VC 
investment of $87 million over an approximately three year period. When paired with the 
findings of the enhanced effects of VC investment relative to corporate investment, this may be 
the equivalent of $269.7 million in traditional R&#038;D investment.
</i></blockquote>
Combine these two studies and you can see how these chilling effects can be quite massive in terms of investment in innovation.  Of course, investment alone is not the sole determinant of the pace or success of innovation, but it is a key factor.  And scaring investors away from innovations can have a major impact on the public and the economy.<br /><br /><a href="http://www.techdirt.com/blog/innovation/articles/20120618/16110519373/chilling-effects-innovation-caused-bad-copyright-law.shtml">Permalink</a> | <a href="http://www.techdirt.com/blog/innovation/articles/20120618/16110519373/chilling-effects-innovation-caused-bad-copyright-law.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/blog/innovation/articles/20120618/16110519373/chilling-effects-innovation-caused-bad-copyright-law.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>it's-feeling-frosty-in-here</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20120618/16110519373</wfw:commentRss>
</item>
<item>
<pubDate>Wed, 2 May 2012 08:49:00 PDT</pubDate>
<title>Apple Rejecting Apps That Use Dropbox Because *Gasp!* Users Might Sign Up For Dropbox Accounts</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20120501/17545618733/apple-rejecting-apps-that-use-dropbox-because-gasp-users-might-sign-up-dropbox-accounts.shtml</link>
<guid>http://www.techdirt.com/articles/20120501/17545618733/apple-rejecting-apps-that-use-dropbox-because-gasp-users-might-sign-up-dropbox-accounts.shtml</guid>
<description><![CDATA[ While I can understand why developers feel the need to conform to Apple's sometimes ridiculous (and often <a href="http://www.techdirt.com/blog/wireless/articles/20110914/04545515948/iphone-developer-creates-app-criticizing-iphone-app-is-quickly-pulled.shtml">arbitrary</a>) rules for iOS development, sometimes it really seems like Apple goes to highly questionable (and potentially legally questionable) lengths to reject certain apps.  The latest, via <a href="http://news.ycombinator.com/item?id=3916826" target="_blank">Hackernews</a>, is that Apple has been <a href="http://forums.dropbox.com/topic.php?id=59350" target="_blank">rejecting apps that make use of Dropbox's cloud storage system</a>.  The reasoning is particularly ridiculous:
<blockquote><i>
Reason for rejection is the fact that if the user does not have Dropbox application installed then the linking authorization is done through Safari (as per latest SDK).
<br /><br />
Once the user is in Safari it is possible for the user to click "Desktop version" and navigate to a place on Dropbox site where it is possible to purchase additional space.
<br /><br />
Apple views this as "sending user to an additional purchase" which is against rules.
</i></blockquote>
Dropbox is trying to work around Apple's excessive rules, but the whole thing seems a bit crazy.  At some point you have to wonder when Apple is going to trip various antitrust rules about using its dominant position on the platform to hurt other companies.  It seems developers are eventually going to recognize that, even with Apple's giant market, it might just be easier to focus on more reasonable and open platforms.<br /><br /><a href="http://www.techdirt.com/articles/20120501/17545618733/apple-rejecting-apps-that-use-dropbox-because-gasp-users-might-sign-up-dropbox-accounts.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20120501/17545618733/apple-rejecting-apps-that-use-dropbox-because-gasp-users-might-sign-up-dropbox-accounts.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20120501/17545618733/apple-rejecting-apps-that-use-dropbox-because-gasp-users-might-sign-up-dropbox-accounts.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>control-control-control</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20120501/17545618733</wfw:commentRss>
</item>
<item>
<pubDate>Mon, 23 Apr 2012 10:10:00 PDT</pubDate>
<title>Dropbox Adds Key Feature That Supposedly Made Megaupload Illegal: Link To Download</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20120423/08500618608/dropbox-adds-key-feature-that-supposedly-made-megaupload-illegal-link-to-download.shtml</link>
<guid>http://www.techdirt.com/articles/20120423/08500618608/dropbox-adds-key-feature-that-supposedly-made-megaupload-illegal-link-to-download.shtml</guid>
<description><![CDATA[ Popular cloud service provider Dropbox has announced <a href="http://blog.dropbox.com/?p=1138" target="_blank">the ability to share stuff in your Dropbox with a link</a>.  This is not a revolutionary offering.  It's actually pretty common and can be quite useful for simple sharing of files.  But, as Mathew Ingram <a href="https://twitter.com/#!/mathewi/status/194422333535039488">noted</a>, this is exactly part of the reason that Megaupload was <a href="http://www.techdirt.com/articles/20120120/00373617487/megaupload-details-raise-significant-concerns-about-what-doj-considers-evidence-criminal-behavior.shtml">accused of criminal conspiracy</a>.  For example, the fact that Megaupload did not provide a "search" feature to find all the content in its cloud, but merely let people link in, was seen as a way to "hide" the fact that infringing material was available.  I am assuming -- given the way Dropbox operates -- that it, too, is not intending to provide a search engine.  It's good to see Dropbox confident enough that it won't be shut down on questionable criminal charges -- but it certainly continues to <a href="http://www.techdirt.com/articles/20120122/23343817505/megaupload-shutdown-means-other-companies-turning-off-useful-services.shtml">raise questions</a> about what the government considers evidence of criminal conspiracy... and how that could create a chill on companies who are, perhaps, less well established than Dropbox. <b>Update</b>: As some have pointed out in the comments, the specific feature is more about viewing content via the link, not downloading.  Sorry, we should have been clearer.  However, again, this fits with the Megavideo style offering of providing access to content without necessarily downloading it.  Still appears to be exactly the part that so concerned the Justice Dept...<br /><br /><a href="http://www.techdirt.com/articles/20120423/08500618608/dropbox-adds-key-feature-that-supposedly-made-megaupload-illegal-link-to-download.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20120423/08500618608/dropbox-adds-key-feature-that-supposedly-made-megaupload-illegal-link-to-download.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20120423/08500618608/dropbox-adds-key-feature-that-supposedly-made-megaupload-illegal-link-to-download.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>warning-signs</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20120423/08500618608</wfw:commentRss>
</item>
<item>
<pubDate>Tue, 21 Jun 2011 03:39:48 PDT</pubDate>
<title>Oops: Dropbox Left All User Accounts Wide Open For Four Hours This Weekend</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20110621/01361414780/oops-dropbox-left-all-user-accounts-wide-open-four-hours-this-weekend.shtml</link>
<guid>http://www.techdirt.com/articles/20110621/01361414780/oops-dropbox-left-all-user-accounts-wide-open-four-hours-this-weekend.shtml</guid>
<description><![CDATA[ Dropbox's security has been under increased scrutiny lately, after some security researchers claimed that some of its security practices were questionable.  So, it was probably the worst time possible for the company to have a "programmer's error," <a href="http://www.wired.com/threatlevel/2011/06/dropbox/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A wired27b %28Blog - 27B Stroke 6 %28Threat Level%29%29" target="_blank">leaving all Dropbox accounts completely wide open to anyone</a> for four hours on Sunday.  Apparently, during that period of time, you could log into anyone's account with <i>any password</i>.  Just type in a random string of gibberish and you're in.  Not surprisingly, the company is <a href="http://blog.dropbox.com/?p=821" target="_blank">apologizing and investigating</a> how this happened.  At the very least, it seems like a good reason to explore alternatives if you're doing remote storage.
<br><br>
Of course, this also raises interesting points concerning the big question of "cloud" security.  Many people have suggested that relying on some third party -- such as Dropbox -- is inherently insecure.  However, that assumes that an individual who goes a different route would be able to create a more secure system on their own.  I'm sure that's true for <i>some people</i>, but it might not be the case for the everyday user.  In the long run, you would hope that these remote service providers can implement stronger security, so that individuals don't have to.  But, in the short run, I wouldn't be surprised to see more such stories of less-than-optimal security being exposed at these kinds of service providers.<br /><br /><a href="http://www.techdirt.com/articles/20110621/01361414780/oops-dropbox-left-all-user-accounts-wide-open-four-hours-this-weekend.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20110621/01361414780/oops-dropbox-left-all-user-accounts-wide-open-four-hours-this-weekend.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20110621/01361414780/oops-dropbox-left-all-user-accounts-wide-open-four-hours-this-weekend.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>hacktastic</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20110621/01361414780</wfw:commentRss>
</item>
<item>
<pubDate>Tue, 26 Apr 2011 08:00:45 PDT</pubDate>
<title>Dropbox Tries To Kill Off Open Source Project With DMCA Takedown</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20110425/15541514030/dropbox-tries-to-kill-off-open-source-project-with-dmca-takedown.shtml</link>
<guid>http://www.techdirt.com/articles/20110425/15541514030/dropbox-tries-to-kill-off-open-source-project-with-dmca-takedown.shtml</guid>
<description><![CDATA[ Teck points us to the troubling news of Dropbox seeking to <a href="http://razorfast.com/2011/04/25/dropbox-attempts-to-kill-open-source-project/" target="_blank">kill off an open source project through questionable means</a>, involving DMCA notices.  As you may have heard, Dropbox got into a bit of a security/privacy kerfuffle lately after some researchers questioned the news that it <a href="http://paranoia.dubfire.net/2011/04/how-dropbox-sacrifices-user-privacy-for.html" target="_blank">uses a hash function to deduplicate files on its servers</a>.  If you don't know, Dropbox is a cloud storage system that's pretty useful.  However, one of the ways it attempted to save some costs was that if you sought to upload a file that was identical to a file on someone else's shared server, it wouldn't actually "upload" your file, but just point you to the single file.  There were clear security and privacy questions about this.
<br /><br />
Of course, some noted that it could also represent an "opportunity" of sorts, and out of that came a project called Dropship -- which used a little hack to use this deduping tech to make Dropbox think you were trying to upload specific content that you might not actually have, and then the actual file (if already stored in someone else's Dropbox) would automatically appear in yours as well.  Obviously, one key use of such a technology would be to make unauthorized copies of music and movies.  Dropbox, for obvious reasons, didn't like that aspect, but its response to this was pretty troubling: it focused on censoring information about Dropship.
<blockquote><i>
Dropbox's CTO and cofounder, Arash Ferdowsi, did not like Dropship. His reaction was swift. According to the project&rsquo;s creator, Wladimir van der Laan, Ferdowsi contacted him soon after and requested "in a really civil way" that he take the project off of github. van der Laan complied. 
</i></blockquote>
Others quickly mirrored the project (some in their own Dropboxes) and Dropbox contacted all of them in a that same "civil way," asking each to remove the content... but in at least one case, with Dan DeFelippi, they sent a DMCA takedown, despite not being the legitimate copyright holder (a violation of the DMCA process).  When confronted on this, Dropbox backed down and claimed that the DMCA notice (and subsequent limits on the guy's account) were really a mistake, but, along with admitting that, Dropbox was still asking the guy to remove all info about Dropship:
<blockquote><i>
Soon after Ferdowsi contacted me directly, sending what I now assume is the same &ldquo;really civil&rdquo; request he sent to others. He requested that I not only remove the archive from Dropbox but delete my posts on Hacker News, which at that point included the fake DMCA takedown. He outlined his objections, that Dropship reveals their proprietary client-server protocol and that it could be used for piracy. He told me that the DMCA takedown was a mistake and reverted the lockdown on my public files.
<br /><br />
First of all, attempting to protect a proprietary protocol is going to get them nowhere. His argument implied security by obscurity. Security by obscurity falls completely flat on its face in this case since their client can be analyzed by anyone with the proper skills and could be deciphered again.
<br /><br />
Second, dealing with piracy is the responsibility of Dropbox. It&rsquo;s not the problem of an innocent hacker who wrote some useful code that could benefit legitimate users and advocates the use of his software for &ldquo;sharing photos, videos, public datasets, git-like source control, or even as building block for wiki-like distributed databases.&rdquo;
</i></blockquote>
While it's good that Dropbox has been <i>mostly</i> civil on this, resorting to a DMCA takedown, even as a mistake, is problematic.  Of course, you can't totally blame Dropbox here.  As we've seen, copyright maximalists in industry and in government seem quite eager to blame tech companies if their tech might possibly be used for unauthorized access.  While the law is almost certainly on Dropbox's side that it has no liability for Dropship, that wouldn't necessarily prevent them from getting hit with an annoying lawsuit.  It's really an unfortunate sign of the copyright times.
<br /><br />
Of course, the end result is also likely to be exactly the opposite of what those maximialists hope.  While DeFelippi notes that Dropbox has been successful in getting many of these mirrors taken down, some are still up (including his) and the whole attempt to censor the project is only going to call that much more attention to it in the long run.  I think there's a name for that phenomenon...<br /><br /><a href="http://www.techdirt.com/articles/20110425/15541514030/dropbox-tries-to-kill-off-open-source-project-with-dmca-takedown.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20110425/15541514030/dropbox-tries-to-kill-off-open-source-project-with-dmca-takedown.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20110425/15541514030/dropbox-tries-to-kill-off-open-source-project-with-dmca-takedown.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>copyright-as-censorship</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20110425/15541514030</wfw:commentRss>
</item>
</channel>
</rss>